Monday, 21 April 2014

Search history on windows 8.1 - Part 2

I have recently blogged about windows 8.1 search history and how searched terms/phrases are recorded as LNK files in a post here. But windows also logs searched terms (search history) to the event log and web history (and cache).

From the LNK files, we know the first time a term was searched for, but not the next time or the last time it was searched, which is usually more relevant from an investigation perspective. However, this information can be obtained from the Connected-Search event log file. On disk it would be under:

Under Event viewer, you can find it under:
 \Applications and Services Logs\Microsoft\Windows\Connected-Search\Operational

Below is a screenshot for one such log entry.

Searched keyword is 'enscript' and machine was online when search was run

Windows logs all URLs and reference links here. Windows, by default tries to search for everything online as well as on the machine. Even if you are offline, a search URL for online searches is generated and seen here. The screenshot below shows the same search run when machine was offline (not connected to internet).

Searching for 'enscript' when machine is offline

Each time a search is run, an entry is created, sometimes multiple entries (this probably has to do with different views when browsing the search results). For searches (if machine was online), the URL requests and responses are also found in the IE web history and cache database (WebcacheV01.dat). The database is located at

The best way to study this data would be by parsing this database either manually (using libesedb and lots of data formatting with additional parsing!) or use a free program like IE10 History reader (or an expensive brand forensic tool). However, if you are just interested in the search terms without dates or other information, a raw search into the datebase files will suffice.

To find searched terms, you will need to search  for URLs beginning with

The screenshot below shows hits when searching the IE web cache files for the above URL using Encase.
Search hits in IE web cache database as seen in encase

Search as you type

An aspect missing from LNK files and the event logs is the search suggestions and interim search results. As Rob Lee hinted to me earlier that a user could search for a term (without hitting Enter or the search button after entering the term in the search box), but not click on any results and none of the above artifacts would be created. Windows uses the 'search as you type' feature and  terms windows guessed for you (as you were typing into the search box) or interim search results are discarded. However you would find some traces of the terms as windows will make online queries for the 'search as you type' feature. If this is not clear, just recall how you search with google. As you begin typing the letters of your keyword into the search box, google automatically suggests most popular searches beginning with those letters. Windows also does the same thing.

Google's search as you type feature

To find such searches which were discarded, search for URLs beginning with

Actually, these are not the suggestions, but the lookups for term/phrase entered into the search box. The data returned (query response) will contain the suggestions.

Below is a screenshot showing the webcacheV01.dat file (and supporting db files) with search hits as displayed in Encase.

Search hits showing Windows querying for popular search term suggestions based on user entered input

Thus there are multiple locations (connected search LNK files, event logs, web cache) where an investigator can find evidence of searches run by a user. Each has its uses and caveats.


  1. Holders Real Madrid will reach the UEFA Champions League semi-final provided they
    can protect a 2-1 lead against Bayern Munich at the Santiago Bernabeu Stadium on Tuesday night.
    The Bundesliga leaders will arrive in the Spanish capital for the quarter-final first leg
    still reeling from the Cristiano Ronaldo double they surrendered at the Allianz Arena last Wednesday.
    However, Bayern could be boosted by the potential return of star striker Robert Lewandowski,
    who missed last week's match through injury.
    Real Madrid vs Atletico Madrid Live
    Real Madrid vs Atletico Madrid Live Stream
    Real Madrid vs Atletico Madrid Live Free
    Real Madrid vs Atletico Madrid Live Free Soccer
    Real Madrid vs Atletico Madrid
    Atletico Madrid vs Real Madrid Live
    Atletico Madrid vs Real Madrid Live Stream
    Watch Bayern Munich vs Real Madrid Free Soccer
    Atletico Madrid vs Real Madrid Online
    Speaking of star attackers, expect Ronaldo, Karim Benzema and Gareth Bale to return for Los Blancos after
    manager Zinedine Zidane left them out of Saturday's 3-2 win over Sporting Gijon in La Liga.



  3. After a quick explosion in Game 4 where Isaiah Thomas knocked down his first five three-point attempts,
    the Wizards held him in check as he only scored four points for the rest of the game.
    The Wizards have thrown a variety of looks at Thomas. They’ve tried matching Wall, Beal,
    Porter, and Oubre (in Game 3) on him. They’ve thrown double teams at Thomas and are much more physical with him when he’s playing off the ball.
    He didn’t get the foul calls in Game 4, but that will likely change as things head back to Boston.
    Celtics vs Wizards
    Celtics vs Wizards Live
    Celtics vs Wizards Live Stream
    Celtics vs Wizards NBA 2017
    Wizards vs Celtics
    Wizards vs Celtics Live
    Wizards vs Celtics Live Stream

    It’s not breaking news but if the Wizards slow down Thomas, that gives them a great chance to win the game.
    The question is, can they do it in Boston?
    The Wizards will need a big game from Bradley Beal to win this one

    After three subpar games, Beal showed up big time in Game 4 with a team-high 29 points including going 3-6 from three-point range.
    Beal has struggled a bit from distance as he’s shooting just 34.6 percent (9-26) for the series.